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DETAILED ACTION 



1 . This action is in response to the amendment filed November 20, 2007 

2. Claims 1,14, and 24 have been amended and claims 17 and 37 have been 
cancelled. 

3. New claim 38 has been added. 

4. Claims 1-16, 18-36, and 38 have been examined and are pending with this 
action. 

Claim Rejections - 35 USC §112 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter, which the applicant regards as his invention. 

5. Claims 1 and 24 previously rejected under 35 U.S.C. 112, second paragraph, as 
being indefinite for failing to particularly point out and distinctly claim the subject matter 
which applicant regards as the invention, has been withdrawn based on the 
amendments made in the pending claims. 



Claim Rejections - 35 USC § 102 
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The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

6. Claims 1-5, 7-16, 18-27, 29-36 and 37 are rejected under 35 U.S.C. 102 (b) as 

being anticipated by Kao ET al. (US 6,070,177). 

INDEPENDENT: 

As per claim 1, Kao teaches an apparatus comprising an application program 
(see col.3, line 67-col.4, line 3: "network client runs a 'web browser', which is simply an 
application program for accessing and providing...") comprising: 

one or more business components, wherein a business component comprises 
one or more fields, wherein the fields correspond to records in a database, and the 
database is separate from the application program (see Fig. 3; col.1 , lines 34-36: 
"database forms are often created to present the data corresponding to a specific 
activity 11 ; and col.3, lines 14-15: "request and receive documents or database files 
comprising data or object descriptors"), 

means for selecting for auditing a business component from the one or more 
business components (see col. 10, lines 8-13: "creating an audit trail for a database form 
or document that is transmitted among users... a user selects a database form to use 
for a particular request"), 
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means for selecting for auditing one or more selected operations on the selected 
business component (see col.5, lines 4-7: "consists of a number of fixed fields that 
indicate the type of data or information to be entered" and col. 7, line 22-39), 

means for creating an audit trail for the application program (see col.4, lines 58- 
62: "stores data created for that program" and col.5, lines 51-56: "information relating to 
each user is appended to the audit trail"), and 

means for providing the audit trail to the database associated with the fields of 
the business component (see col.4, lines 58-67: "Various types of data relating to 
different activities can be stored in a network server 104 by the database application"). 

As per claim 14, Kao teaches a system comprising: 
a processor (see col. 3, lines 15-20: "CPU"); and 
a memory coupled to the processor and storing 

a first set of instructions, executable by the processor (see col. 3, lines 26-28: 
"loaded into memory"), configured to provide a business component wherein the 
business component comprises one or more field, wherein the fields correspond to 
records in a database, and the database is separate from the application program (see 
Fig. 3; col.1 , lines 34-36: "database forms are often created to present the data 
corresponding to a specific activity"; and col.3, lines 14-15: "request and receive 
documents or database files comprising data or object descriptors"), 

a second set of instructions (see col.3, lines 26-28: "instructions"), executable by 
the processor, configured to provide user interface (see col.3, line 67-col.4, line 3: "web 
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browser"), wherein the user interface is configured to allow selection for auditing of a 
selected field of the one or more fields and one or more selected operations on the 
selected fields (see col. 10, lines 8-13: "creating an audit trail for a database form or 
document that is transmitted among users... a user selects a database form to use for a 
particular request"), 

a third set of instructions (see col.3, lines 26-28: "instructions"), executable by the 
processor, configured to detect when the selected operations are performed on the 
selected fields (see col. 6, lines 46-51 : "automatically entered by the client computer or 
server computer upon a specific event"), 

a fourth set of instructions (see col.3, lines 26-28: "instructions"), executable by 
the processor, configured to generate an audit transaction record regarding the selected 
field when the selected operations are detected (see col.9, lines 21-24: "data in the 
audit trail con only be added or modified by specific actions related to the transmission 
of the request"), and 

a fifth set of instructions (see col.3, lines 26-28: "instructions"), executable by the 
processor, configured to provide the audit transaction record to the database associated 
with the fields of the business component (see col. 4, lines 58-67: "Various types of data 
relating to different activities can be stored in a network server 104 by the database 
application"). 



As per claim 24, Kao teaches a method comprising: 
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auditing an application program wherein said auditing comprises creating an 
audit trail (see col.4, lines 58-62: "stores data created for that program" and col. 5, lines 
51-56: "information relating to each user is appended to the audit trail"); 

using the application program (see col.3, line 67-col.4, line 3: "network client runs 
a 'web browser', which is simply an application program for accessing and providing...") 
to perform audit trail functions (see col.2, lines 63-64: "associating an audit trail with a 
database form is disclosed") comprising: 

generating a list of business components included in the application program, 
wherein a business component of the list of business components comprises one or 
more fields, wherein the fields correspond to records in a database, and the database is 
separate from the application program (see Fig. 3; col.1 , lines 34-36: "database forms 
are often created to present the data corresponding to a specific activity"; and col.3, 
lines 14-15: "request and receive documents or database files comprising data or object 
descriptors"), 

presenting the list of business components to a user (see Fig. 3 and Fig. 4); 

allowing the user to select for auditing a selected business component (see 
col. 10, lines 8-13: "creating an audit trail for a database form or document that is 
transmitted among users... a user selects a database form to use for a particular 
request"); 

presenting the list of operations that can be performed on the selected business 
component to the user (see Fig. 4 and Fig. 5); 
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allowing the user to select for auditing one or more selected operations for the 
selected business component (see col. 5, lines 4-7: "consists of a number of fixed fields 
that indicate the type of data or information to be entered" and col. 7, line 22-39), and 

providing the audit trail to the database associated with the fields of the business 
component (see col.4, lines 58-67: "Various types of data relating to different activities 
can be stored in a network server 104 by the database application"). 

DEPENDENT: 

As per claim 2, which depends on claim 1 , Kao further teaches wherein the 
application program further comprises: means for detecting when the selected 
operations are performed (see col. 6, lines 46-51: "automatically entered by the client 
computer or server computer upon a specific event"). 

As per claim 3, which depends on claim 2, Kao further teaches wherein the 
application program further comprises: means for generating an audit transaction record 
regarding the business component when the selected operations are detected (see 
col. 5, lines 51-56: "information relating to each user is appended to the audit trail"). 

As per claim 4, 15, and 25, which depend on claims 1,14, and 24, respectively, 
Kao further teaches wherein the selected or list of operations to be audited include at 
least one of: update, add, copy, and delete (see col. 5, lines 11-13: "modify the data 
within the form"). 

As per claim 5, 16, and 26, which depend on claims 1, 14, and 24, respectively, 
Kao teaches of further comprising means for allowing the user to restrict access to the 
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audit trail by at least one of: an employee identifier, an employment position, and an 
area of responsibility (see col.5, lines 29-33: "authorized to make changes"; col.6, lines 
19-22; and col.7, lines 42-44: "employee to a supervisor or personnel department"). 

As per claims 7, 18, and 29, which depend on claims 3, 14, and 27, respectively, 
Kao teaches of further comprising means for storing the audit transaction record in a file 
(see col.4, lines 47-50: "that create and store files and data"). 

As per claims 8, 19, and 30, which depend on claims 7, 18, and 29, respectively, 
Kao further teaches wherein the means for providing the audit trail comprises means for 
importing the audit transaction record stored in the file to the database (see col.4, lines 
58-67: "The data can be entered into the server computer directly or into a client 
computer coupled to the server over a network"). 

As per claims 9, 20, and 31, which depend on claims 3, 14, and 27, respectively, Kao further teaches wherein the audit 
transaction record includes at least one of: an identifier for the entity that accessed the business component or the field, the 
operation that was performed on the business component, when the operation was performed, a previous value of the field, a 
current value of the field, and how the value of at least a portion of the business component was changed (see col.5, lines 40- 
44: "lists such information as the name or ID of the user who created the form , the names or ID'S of each of the users who 
received the form, the data and time of reception, any action taken by each user, and other such information"). 

As per claims 10, 21, and 32, which depend on claims 3, 14, and 27, 
respectively, Kao teaches of further comprising means for allowing the user to query 
one or more of the audit transaction records (see col.5, lines 40-48: "provides a means 
by which the transmission history and actions taken regarding a particular document, 
set of data, or database form may be viewed by the users of the document or form"). 

As per claims 11, 23, and 33, which depend on claim 2, 14, and 27, 
respectively, Kao teaches of further comprising means for prompting the user to enter a 
comment or a description of the operation when the selected operations are detected 
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(see col.6, lines 53-56: "Other fields in the audit trail may be text entry fields that allow a 
user to type information directly into the audit trail"). 

As per claims 12 and 34, which depend on claims 1 and 24, respectively, Kao 
further teaches wherein the one or more selected business components comprise one 
or more fields, and further comprising: means for selecting the one or more fields to be 
audited (see col. 7, lines 22-24: "make changes or revisions to the contents of a form"; 
and col. 10, lines 8-13: "a user selects a database form to use for a particular request"); 
and means for generating an audit transaction record when one of the selected 
operations on one of the selected fields is detected (see col.6, lines 46-51 : 
"automatically entered by the client computer or server computer upon a specific 
event"). 

As per claims 13, 22 and 35, which depend on claims 1,14, and 34, 
respectively, Kao teaches of further comprising means for allowing the user to restore 
the one or more of the fields to a previous state or value (see col. 8, lines 48-55: "return 
the request back"). 

As per claim 27, which depend on claim 24, Kao teaches of further comprising: 
detecting when the selected operations are performed on one of the selected business 
components (see col.6, lines 46-51 : "automatically entered by the client computer or 
server computer upon a specific event"); and generating an audit transaction record 
when the selected operations are detected (see col. 9, lines 21-24: "data in the audit trail 
con only be added or modified by specific actions related to the transmission of the 
request"). 
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As per claim 36, which depend on claim 24, Kao further teach of a computer- 
readable storage medium comprising: instructions for implementing the method of claim 
24 (see col.3, lines 26-50: "instructions"). 

As per claim 38, which depends on claim 1 , Kao further teaches wherein the 
application further comprises means for selectively activating and deactivating the audit 
trail (see col. 5, lines 1-7). 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. Claims 6 and 28 are rejected under 35 U.S.C. 103(a) as being unpatentable over 

Kao et al. (US 6,070,177) in view of Rivera et al. (US 6,056,786). 

As per claim 6 and 28, which depend on claims 3, 14, and 27, respectively, Kao 
does not explicitly teach of further comprising means for storing the audit transaction 
record in an external database. 

Rivera teaches storing the audit transaction record in an external database (see 
col. 6, lines 21-24: "The audit log 72 can be stored in an internal data base of the server 
program 64 or in an external database"). 

It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to modify the system of Kao in view of Rivera by implementing 
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storing the audit transaction record in an external database. One would be motivated to 
do so because Kao teaches that the network of the invention comprises the World Wide 
Web, which clearly consists of internal and external databases, and because the 
storage locale of any data is subjective. 



Response to Arguments 

8. Applicant's arguments filed November 20, 2007 have been fully considered but 
they are not persuasive. 

The applicant(s) argue that the claimed "business components" and Kao's 
"database form" are not equivalent. In response, the claim does not explicitly teach 
within the claim language, what a business form is such that it is clearly distinguish over 
Kao's database form. In particular, Kao teaches that the invention pertains to "a wide 
variety of business applications" (see col.1 , lines 19-22). One of ordinary skill in the art 
would concur that any documents taught by Kao is in relations to a business component 
of an application. 

The applicant(s) further argue that Kao's database form and its intended use is 
not the same as the business component being selected for auditing. Although Kao 
does teach that the database form is selected by the user to use for a particular request, 
Kao also teaches creating an audit trail for a database form or document (see col. 10, 
lines 8-13). The selection of the database form according to Kao is merely the initial 
step of selecting a business component to be audited. 
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In response to the applicant(s) argument with respect to the limitation "means for 
selecting for auditing one or more selected operations on the selected business 
component", new reference locations were cited to better teach this limitation. 
Furthermore, it is noted that the features upon which applicant relies (i.e., ""selected 
operations" claimed include not only modification, but at least creation, deletion, and 
reproduction as well") are not recited in the rejected claim(s). Although the claims are 
interpreted in light of the specification, limitations from the specification are not read into 
the claims. See In re Van Geuns, 988 F.2d 1 181 , 26 USPQ2d 1057 (Fed. Cir. 1993). 

Applicant(s) argue that the limitations of claim 10 are not taught by Kao. The 
examiner disagrees. Kao teaches the ability for users to view transmission history and 
actions taken on a particular document. Clearly, since the information is a history, it is 
inherent that the history needs to be requested (i.e., searched, queried). 

Since the broad limitations of claims 1-5, 7-16, 18-27, 29-36 and 37 are explicitly 
taught by Kao, Rivera et al. (US 6,056,786) is not relied upon to teach these limitations. 
Rivera explicitly teaches the missing limitations of claim 6 and 28. 

Conclusion 

9. For the reason above claims 1-16, 18-36, and 38 have been rejected and remain 
pending. 

10. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 
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§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

1 1 . Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael Y. Won whose telephone number is 571-272- 
3993. The examiner can normally be reached on M-Th: 7AM-5PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Saleh Najjar can be reached on 571-272-4006. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Michael Won/ 
Primary Examiner 
December 14, 2007 



